Tag Info

Hot answers tagged

23

I actually think the Mozilla devs have been pretty smart with this. Historically, most PDF exploits have come from the rendering engine rather than the parsing side. Adobe got wise early to the fact that malformed structure and content would screw them, and put a lot of effort into making sure that their parsing engine was rock solid. If you look at some of ...


12

Exploits fall into roughly two distinct categories: those which break the semantic rules of the implementation language (buffer overflows, use-after-free, uncontrolled type casts...) and those which play "by the rules". Since the new PDF reader is written in Javascript, exploits from the first category ought to be extremely rare, because of the intrinsic ...


10

I install a plugin that allows me to click on any part of a page and it gives me the color of the clicked object For this to work, the plugin needs to register a click event handler and it needs to interact with the document object model of the current HTML page. HTML was originally designed to share scientific documents. And while we build complex web ...


7

My German is pretty rusty, but I'm pretty sure the article from Heise Security doesn't really say what the H-online article claims. Unter Opera erreicht man die Plugin-Verwaltung durch die Eingabe von opera:plugins in die Adressleiste. Beim Internet Explorer genügt das Deaktiveren der Plug-ins unter "Add-Ons verwalten" nicht. Wer den IE einsetzt, sollte ...


5

As suggested by bstpierre, you cannot protect yourself against malicious users since a plugin allows by definition to run arbitrary code. However, if you want to prevent the abuse case where an innocent user downloads a plugin which seems legit but is not, you can do some signature checking with asymmetric crypto to make sure that this does not happen. ...


4

You are right. There are really many ways for a website to store persistent data on you, even if you dont want them too. Evercookie by Samy Kamkar is an example of this. Quotede from the site of Evercookie it stores persistent data on you with the help of these storage mechanisms: Standard HTTP Cookies Local Shared Objects (Flash Cookies) ...


4

Actually, depending on the browser and plugins used, there are many ways for a website to store persistent information on users' computer. It's not cookies and cache anymore. Some of these new methods require user confirmation, some don't - it also varies by browser. Flash has Local Shared Objects, Silverlight has Isolated Storage, HTML5 itself gives Offline ...


4

According to my experience it works fine (copy/paste and modify and CP again). However i have change only the name of the field to test a path manipulation. And it was a success. You might have issue with your webapp.


4

Disabling the add-ons is not enough. CERT writes in one of its vulnerability notes: Disable the Java plug-in and Java Deployment Toolkit for Internet Explorer Disabling the Java plug-in for Internet Explorer is significantly more complicated than with other browsers. There are multiple ways for a web page to invoke a Java applet, and multiple ways ...


3

PDF exploits are not exploiting the PDF file format. Instead, they are exploiting vulnerabilities found in the PDF reader. If a PDF files contains an exploit for Adobe's reader, opening the file using pdf.js will prevent the exploit from working. Assuming Mozilla is fixing the bugs in pdf.js on a regular basis, this can reduce the impact of PDF exploits. ...


3

Usually it is possible to modify the POST request by copy/pasting into a text editor. But not always, I find it will often cause problems when posting JSON. This process can also damage the content-type and content-size, although it usually fixes this for you (but it is unreliable). In general I find standalone proxies to be easier to use and more ...


3

Silverlight can actually access the local filesystem, depending on the permissions granted. It is subject to .NET security mechanisms, but if these are badly configured, it is possible to read a user's files, or even change them.


3

Since 6u10 Java applets have been able to store "muffins" (effectively cookies) using java.jnlp.PersistenceService. Also from the same release, Java applets can also open files through FileOpenService, FileSaveService and ExtendedService.


3

The basic problem is that the plugin model doesn't have a properly defined/granular authorization policy. In a lot of cases its all or nothing when it comes to certain pieces of information. Maybe the plugin needs to know the particular URL of the page you are on. Well that might require access to browsing history, etc. The other part of the problem is ...


2

Your searches must have missed the GitHub repo, which is highlighted on w3af.org. Examples are all there.


2

Greasemonkey allows you to basically have a scriptable API into website/data/view manipulation using JavaScript. It is beneficial in IT security to use to automate some things or even to give yourself a more usable view for output you may be receiving You can't really mitigate anything GreaseMonkey does directly persay, but preventing automation of ...


1

Greasemonkey is a useful tool for influencing how a page behaves. From a secuirty perspective Greasemonkey isn't really a tool for auditing, its a tool for leveraging flaws. It can be helpful in leveraging client side trust vulnerabilities, but its not the only way. For instance if your application is performing data validation in JavaScript then ...


1

I appreciate the way you are trying to protect your users; kudos. However, I also want to inject a small note of caution, so you know what you are getting into. The hardest part is not the cryptography (e.g., public-key signatures). The hardest part is the process for determining which plugins are considered legitimate. Are you going to act as a ...



Only top voted, non community-wiki answers of a minimum length are eligible